Overview
overview
7Static
static
3f529d7434c...18.exe
windows7-x64
7f529d7434c...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.exe
windows7-x64
3$PLUGINSDI...er.exe
windows10-2004-x64
3$PLUGINSDI...ar.exe
windows7-x64
3$PLUGINSDI...ar.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ne.exe
windows7-x64
7$PLUGINSDI...ne.exe
windows10-2004-x64
7AdminWorker.exe
windows7-x64
3AdminWorker.exe
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3WebInstaller.exe
windows7-x64
6WebInstaller.exe
windows10-2004-x64
6WebUpdater.exe
windows7-x64
3WebUpdater.exe
windows10-2004-x64
3content/iwa-ovr.js
windows7-x64
3content/iwa-ovr.js
windows10-2004-x64
3content/iwinarcade.js
windows7-x64
3content/iwinarcade.js
windows10-2004-x64
3content/un...l.html
windows7-x64
3content/un...l.html
windows10-2004-x64
3Analysis
-
max time kernel
94s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 04:17
Static task
static1
Behavioral task
behavioral1
Sample
f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstGameInfoHelper.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstGameInfoHelper.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/IwinToolbar.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/IwinToolbar.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/smartinstallAllinOne.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/smartinstallAllinOne.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
AdminWorker.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
AdminWorker.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
WebInstaller.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
WebInstaller.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
WebUpdater.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
WebUpdater.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
content/iwa-ovr.js
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
content/iwa-ovr.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
content/iwinarcade.js
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
content/iwinarcade.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
content/uninstall.html
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
content/uninstall.html
Resource
win10v2004-20240802-en
General
-
Target
f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe
-
Size
3.6MB
-
MD5
f529d7434ca8ef314c197e4a486cf39b
-
SHA1
f9719dda8560f18d8a6bd238623527bfc1a1af1d
-
SHA256
3cf1792dee586bf8aaf00c67f1f424455181a5ca886cb4253ea0c8989e7e5ee3
-
SHA512
c26a1b094de31a7f4670eda7d5c44f9cea88018d05692ddbdbee3a08ffade2db313dbef9d39a0ee3ce12ada8175eb2ce3d49608d6f7166f1a5b6770611a741b9
-
SSDEEP
49152:K0c24StiTTsdoNDjoJSFWWCycq1mFDbPd3Zm7BmKGMkO/VcmFJRUZYUxPIatLmE/:K36ivJDiSFdph1mPYAlO/hJ6ZYWpqn8
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation iWinGames.exe -
Executes dropped EXE 64 IoCs
pid Process 328 InstGameInfoHelper.exe 432 AdminWorker.exe 1220 AdminWorker.exe 1764 iWinTrusted.exe 1600 WebInstaller.exe 1772 WebInstaller.exe 4268 iwintoolbar.exe 1000 iWinGames.exe 4460 iWinGames.exe 4520 iWinGames.exe 2856 iWinGames.exe 684 iWinGames.exe 3476 iWinGames.exe 528 iWinGames.exe 2192 iWinGames.exe 2204 iWinGames.exe 1808 iWinGames.exe 4724 iWinGames.exe 596 iWinGames.exe 2748 iWinGames.exe 1276 iWinGames.exe 2296 iWinGames.exe 3604 iWinGames.exe 4112 iWinGames.exe 628 iWinGames.exe 2200 iWinGames.exe 1724 iWinGames.exe 4004 iWinGames.exe 1796 iWinGames.exe 4928 iWinGames.exe 3456 iWinGames.exe 2840 iWinGames.exe 2080 iWinGames.exe 3804 iWinGames.exe 2620 iWinGames.exe 3420 iWinGames.exe 4988 iWinGames.exe 2288 iWinGames.exe 2756 iWinGames.exe 3536 iWinGames.exe 2548 iWinGames.exe 1140 iWinGames.exe 3760 iWinGames.exe 1416 iWinGames.exe 4416 iWinGames.exe 1632 iWinGames.exe 5108 iWinGames.exe 3408 iWinGames.exe 1660 iWinGames.exe 3108 iWinGames.exe 3308 iWinGames.exe 4668 iWinGames.exe 4276 iWinGames.exe 3284 iWinGames.exe 404 iWinGames.exe 4196 iWinGames.exe 1268 iWinGames.exe 4736 iWinGames.exe 4612 iWinGames.exe 3636 iWinGames.exe 3164 iWinGames.exe 4388 iWinGames.exe 3076 iWinGames.exe 3816 iWinGames.exe -
Loads dropped DLL 9 IoCs
pid Process 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 1484 regsvr32.exe 2796 regsvr32.exe 2764 regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8CA5ED52-F3FB-4414-A105-2E3491156990} regsvr32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\iWin Games\gamepage\images\ous\opal.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\arcadeCheck.js f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\firefox\iWinArcadeLauncher.exe f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\common\header-small-bg.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\plans\plan2.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\styles\base.css f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\terrie404.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\buttons\continue-orange-132.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\sounds\slidebackin.wav f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\common.js f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\Uninstall.exe f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\bg_header.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\continuefreetrial-32.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\styles\shoppingcart.css f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\AdminWorker.exe f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\ous\hotel-bg.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\sounds\animationBack.wav f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\css\offline.css f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\alert32x32.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\ous\hotel-iwin.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\firefox\chrome\iwinarcade.jar f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\WebUpdater.bmp f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\firefox\version f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\common\header-bg.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\global\page-bg-swirly.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\offlineBg.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\sounds\button_click.wav f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\sounds\download_completed.wav f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\sounds\start.wav f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\WebUpdater.exe f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\buttons\close-blue-28.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\common\loading.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\global\page-header-small-bg.jpg f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\misc\information.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\scripts\popups.js f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\styles\disconnected-upsell.css f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\error.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\firefox\chrome.manifest f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\offline.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\disconnected-upsell.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\expired.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\open.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\global\page-bg.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\ous\eus.jpg f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\ous\opalbox.jpg f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\ous\ous-promo-banner.jpg f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\iWinGames.exe f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\login.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\maintenance.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\orange-im-connected-60.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\test.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\sounds\coins.wav f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\blank2.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\host.cfg f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\plans\plan1.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\alert32x32.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\blank.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\iwin_logo.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\iWin Games\ftdownload.dat f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\global\logo-invis.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\images\ous\divider.gif f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\scripts\disconnected-upsell.js f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\pages\offline.jpg f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe File created C:\Program Files (x86)\iWin Games\gamepage\operationfailed.html f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iWinGames.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" iWinGames.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iWinGames.exe = "8000" f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iWinGames.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iWinGames.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\IESettingSync iWinGames.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\InprocServer32\ = "C:\\Program Files (x86)\\iWin Games\\iWinGamesHookIE.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\iwin f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44E6B68E-8DA5-4093-921B-7275E5B3906A}\1.0 iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8EE3F31F-7498-4A88-9727-299EAFF24150}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\ = "IEHlprObj Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B891343-654E-4301-800B-1803B17A61EF}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E3EF583-8811-4D6F-8EFD-68B2ECD040C0}\TypeLib\ = "{8EE3F31F-7498-4A88-9727-299EAFF24150}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{635ADC07-6F19-42a7-8043-EDD19678CE14}\VersionIndependentProgID\ = "iWinTrusted.CoiWinTrusted" iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{635ADC07-6F19-42a7-8043-EDD19678CE14}\LocalServer32\ = "\"C:\\Program Files (x86)\\iWin Games\\iWinTrusted.exe\" /server" iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\ = "IEHlprObj Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B891343-654E-4301-800B-1803B17A61EF}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B16338D-AFD9-46FF-8BEE-4FEC95946937}\TypeLib\Version = "1.0" iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}\ = "IIEHlprObj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}\TypeLib\ = "{495874FE-4A82-4AD1-9476-0B957E0B95EB}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\iwin\DefaultIcon\ = "\"C:\\Program Files (x86)\\iWin Games\\iWinGames.exe\",0" f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{635ADC07-6F19-42a7-8043-EDD19678CE14}\VersionIndependentProgID iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44E6B68E-8DA5-4093-921B-7275E5B3906A}\1.0\0\win32\ = "C:\\Program Files (x86)\\iWin Games\\iWinTrusted.exe" iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\iwin\URL Protocol f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\ProgID\ = "IEHlprObj.IEHlprObj.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\iWinSupport.iWinSupport.1\ = "iWinSupport Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\iwin\shell\open\command f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{635ADC07-6F19-42a7-8043-EDD19678CE14}\ = "iWinTrusted Class" iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{495874FE-4A82-4AD1-9476-0B957E0B95EB}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8EE3F31F-7498-4A88-9727-299EAFF24150}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ForseRemove iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{495874FE-4A82-4AD1-9476-0B957E0B95EB}\1.0\0\win32\ = "C:\\Program Files (x86)\\iWin Games\\iWinGamesHookIE.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B891343-654E-4301-800B-1803B17A61EF}\InprocServer32\ = "C:\\Program Files (x86)\\iWin Games\\iWinInfo.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44E6B68E-8DA5-4093-921B-7275E5B3906A}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\iWin Games\\" iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{495874FE-4A82-4AD1-9476-0B957E0B95EB}\1.0\ = "iFunWebHookIE Type Library for IE Integration" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B16338D-AFD9-46FF-8BEE-4FEC95946937}\ = "IiWinTrusted" iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B16338D-AFD9-46FF-8BEE-4FEC95946937}\TypeLib iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B16338D-AFD9-46FF-8BEE-4FEC95946937}\TypeLib\ = "{44E6B68E-8DA5-4093-921B-7275E5B3906A}" iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{495874FE-4A82-4AD1-9476-0B957E0B95EB}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{495874FE-4A82-4AD1-9476-0B957E0B95EB}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\iWinTrusted.CoiWinTrusted\ = "iWinTrusted Class" iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{635ADC07-6F19-42a7-8043-EDD19678CE14}\ProgID iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B16338D-AFD9-46FF-8BEE-4FEC95946937}\ProxyStubClsid32 iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B891343-654E-4301-800B-1803B17A61EF}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E3EF583-8811-4D6F-8EFD-68B2ECD040C0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{495874FE-4A82-4AD1-9476-0B957E0B95EB}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}\TypeLib\ = "{495874FE-4A82-4AD1-9476-0B957E0B95EB}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\iWinSupport.iWinSupport.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\iWinSupport.iWinSupport\CurVer\ = "iWinSupport.iWinSupport.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\iWinTrusted.CoiWinTrusted\CurVer iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44E6B68E-8DA5-4093-921B-7275E5B3906A}\1.0\0 iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B16338D-AFD9-46FF-8BEE-4FEC95946937} iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B891343-654E-4301-800B-1803B17A61EF}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{635ADC07-6F19-42a7-8043-EDD19678CE14}\ = "iWinTrusted" iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44E6B68E-8DA5-4093-921B-7275E5B3906A}\1.0\FLAGS iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8EE3F31F-7498-4A88-9727-299EAFF24150}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\iwin\DefaultIcon f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\iWinTrusted.CoiWinTrusted.1 iWinTrusted.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{635ADC07-6F19-42a7-8043-EDD19678CE14} iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{44E6B68E-8DA5-4093-921B-7275E5B3906A}\1.0\FLAGS\ = "0" iWinTrusted.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B891343-654E-4301-800B-1803B17A61EF}\ProgID\ = "iWinSupport.iWinSupport.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B16338D-AFD9-46FF-8BEE-4FEC95946937}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" iWinTrusted.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1000 iWinGames.exe 1000 iWinGames.exe 1000 iWinGames.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 372 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 372 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4268 iwintoolbar.exe 4268 iwintoolbar.exe 1000 iWinGames.exe 4460 iWinGames.exe 4520 iWinGames.exe 2856 iWinGames.exe 684 iWinGames.exe 3476 iWinGames.exe 528 iWinGames.exe 2192 iWinGames.exe 2204 iWinGames.exe 1808 iWinGames.exe 4724 iWinGames.exe 596 iWinGames.exe 2748 iWinGames.exe 1276 iWinGames.exe 2296 iWinGames.exe 3604 iWinGames.exe 4112 iWinGames.exe 628 iWinGames.exe 2200 iWinGames.exe 1724 iWinGames.exe 4004 iWinGames.exe 1796 iWinGames.exe 4928 iWinGames.exe 3456 iWinGames.exe 2840 iWinGames.exe 2080 iWinGames.exe 3804 iWinGames.exe 2620 iWinGames.exe 3420 iWinGames.exe 4988 iWinGames.exe 2288 iWinGames.exe 2756 iWinGames.exe 3536 iWinGames.exe 2548 iWinGames.exe 1140 iWinGames.exe 3760 iWinGames.exe 1416 iWinGames.exe 4416 iWinGames.exe 1632 iWinGames.exe 5108 iWinGames.exe 3408 iWinGames.exe 1660 iWinGames.exe 3108 iWinGames.exe 3308 iWinGames.exe 4668 iWinGames.exe 4276 iWinGames.exe 3284 iWinGames.exe 404 iWinGames.exe 4196 iWinGames.exe 1268 iWinGames.exe 4736 iWinGames.exe 4612 iWinGames.exe 3636 iWinGames.exe 3164 iWinGames.exe 4388 iWinGames.exe 3076 iWinGames.exe 3816 iWinGames.exe 1220 iWinGames.exe 4164 iWinGames.exe 1764 iWinGames.exe 4152 iWinGames.exe 740 iWinGames.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 748 wrote to memory of 328 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 82 PID 748 wrote to memory of 328 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 82 PID 748 wrote to memory of 328 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 82 PID 748 wrote to memory of 432 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 91 PID 748 wrote to memory of 432 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 91 PID 748 wrote to memory of 432 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 91 PID 748 wrote to memory of 1220 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 92 PID 748 wrote to memory of 1220 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 92 PID 748 wrote to memory of 1220 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 92 PID 748 wrote to memory of 1764 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 94 PID 748 wrote to memory of 1764 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 94 PID 748 wrote to memory of 1764 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 94 PID 748 wrote to memory of 1600 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 95 PID 748 wrote to memory of 1600 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 95 PID 748 wrote to memory of 1600 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 95 PID 1600 wrote to memory of 1484 1600 WebInstaller.exe 96 PID 1600 wrote to memory of 1484 1600 WebInstaller.exe 96 PID 1600 wrote to memory of 1484 1600 WebInstaller.exe 96 PID 748 wrote to memory of 1772 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 97 PID 748 wrote to memory of 1772 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 97 PID 748 wrote to memory of 1772 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 97 PID 1772 wrote to memory of 2796 1772 WebInstaller.exe 98 PID 1772 wrote to memory of 2796 1772 WebInstaller.exe 98 PID 1772 wrote to memory of 2796 1772 WebInstaller.exe 98 PID 748 wrote to memory of 2764 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 99 PID 748 wrote to memory of 2764 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 99 PID 748 wrote to memory of 2764 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 99 PID 748 wrote to memory of 4268 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 100 PID 748 wrote to memory of 4268 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 100 PID 748 wrote to memory of 4268 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 100 PID 748 wrote to memory of 1000 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 101 PID 748 wrote to memory of 1000 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 101 PID 748 wrote to memory of 1000 748 f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe 101 PID 1000 wrote to memory of 11104 1000 iWinGames.exe 557 PID 1000 wrote to memory of 11104 1000 iWinGames.exe 557 PID 1000 wrote to memory of 11104 1000 iWinGames.exe 557 PID 1000 wrote to memory of 11180 1000 iWinGames.exe 559 PID 1000 wrote to memory of 11180 1000 iWinGames.exe 559 PID 1000 wrote to memory of 11180 1000 iWinGames.exe 559
Processes
-
C:\Users\Admin\AppData\Local\Temp\f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f529d7434ca8ef314c197e4a486cf39b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\nsp924E.tmp\InstGameInfoHelper.exe"C:\Users\Admin\AppData\Local\Temp\nsp924E.tmp\InstGameInfoHelper.exe"2⤵
- Executes dropped EXE
PID:328
-
-
C:\Program Files (x86)\iWin Games\AdminWorker.exe"C:\Program Files (x86)\iWin Games\AdminWorker.exe" AddArcadeToFireWallExceptions2⤵
- Executes dropped EXE
PID:432
-
-
C:\Program Files (x86)\iWin Games\AdminWorker.exe"C:\Program Files (x86)\iWin Games\AdminWorker.exe" restoreShortcutsPathes2⤵
- Executes dropped EXE
PID:1220
-
-
C:\Program Files (x86)\iWin Games\iWinTrusted.exe"C:\Program Files (x86)\iWin Games\iWinTrusted.exe" -install2⤵
- Executes dropped EXE
- Modifies registry class
PID:1764
-
-
C:\Program Files (x86)\iWin Games\WebInstaller.exe"C:\Program Files (x86)\iWin Games\WebInstaller.exe" -uninstall2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /u "C:\Program Files (x86)\iWin Games\iWinGamesHookIE.dll"3⤵
- Loads dropped DLL
PID:1484
-
-
-
C:\Program Files (x86)\iWin Games\WebInstaller.exe"C:\Program Files (x86)\iWin Games\WebInstaller.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s /i "C:\Program Files (x86)\iWin Games\iWinGamesHookIE.dll"3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2796
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\iWin Games\iWinInfo.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\nsp924E.tmp\iwintoolbar.exeiwintoolbar.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4268
-
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Program Files (x86)\iWin Games\iWinTrusted.exe"C:\Program Files (x86)\iWin Games\iWinTrusted.exe" -install3⤵PID:11104
-
-
C:\Program Files (x86)\iWin Games\AdminWorker.exe"C:\Program Files (x86)\iWin Games\AdminWorker.exe" StartProcessNoWait "C:\Program Files (x86)\iWin Games\\iWinTrusted.exe" "-install"3⤵PID:11180
-
-
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4460
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4520
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2856
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:684
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3476
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:528
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2192
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2204
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1808
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4724
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:596
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2748
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1276
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2296
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3604
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4112
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:628
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2200
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1724
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4004
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1796
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4928
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3456
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2840
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2080
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3804
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2620
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3420
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4988
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2288
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2756
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3536
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2548
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1140
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3760
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1416
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4416
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5108
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3408
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3108
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3308
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4668
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4276
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3284
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:404
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4196
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1268
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4736
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4612
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3636
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3164
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4388
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3076
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3816
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1220
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4164
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1764
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:4152
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:740
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:2468
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:1116
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:3120
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:2796
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:2900
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:1616
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:4232
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:4924
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:4168
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:1212
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:512
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2552
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:4268
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:2612
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:4984
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:1176
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:3396
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:3132
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4444
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:696
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:3576
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5128
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5140
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5160
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5176
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5192
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5208
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5224
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5240
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5256
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5272
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5288
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5304
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5320
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5336
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5352
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5368
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5384
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5400
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5416
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5432
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5448
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5464
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5476
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5496
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5512
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5528
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5544
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5560
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5576
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5592
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5604
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5620
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5640
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5656
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5668
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5684
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5704
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5720
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5736
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5748
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5768
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5784
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5800
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5816
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5832
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5844
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5860
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5880
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5896
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5912
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5928
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5944
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5960
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5976
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:5992
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6008
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6024
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6040
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6056
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:6072
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:6088
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6104
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6120
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6136
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:1428
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:1708
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2388
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6160
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6176
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6192
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6208
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6224
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6240
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6256
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6272
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6288
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6304
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6320
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6336
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6352
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6368
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6384
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6400
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6416
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6432
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:6452
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6468
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6488
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6504
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6520
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6536
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6552
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6568
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6584
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6600
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6616
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:6632
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6648
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6664
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6680
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6696
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6712
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6728
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6748
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6764
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6780
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6796
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:6812
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6828
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6844
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6860
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6876
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:6892
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6908
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6924
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:6956
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6988
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7004
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7020
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7060
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7076
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7092
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7112
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7128
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7144
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7164
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:4932
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:4288
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:2600
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:4344
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:3628
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1320
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6744
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:848
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7188
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:7208
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7228
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7252
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7268
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7284
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7300
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7320
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7336
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7352
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7368
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7388
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7404
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7420
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7436
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7452
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7468
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7484
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7500
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7516
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7536
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7552
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7568
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:7588
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:7604
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7620
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7636
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7652
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7668
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7688
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7708
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:7724
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7748
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7796
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7812
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7828
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7844
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7860
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7876
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7892
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7912
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7928
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:7944
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7960
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7976
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7992
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8008
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8024
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8040
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8056
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8072
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8088
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8104
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8120
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8140
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8156
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8172
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8188
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:6980
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:5072
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:6448
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7532
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8196
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8212
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8228
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8244
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8260
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8276
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8292
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8308
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8324
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8340
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8356
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8372
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8388
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8404
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8420
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8440
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8460
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8476
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8492
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8512
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8528
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8544
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8560
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8576
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8592
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8608
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8624
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8640
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8656
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8672
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8688
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8704
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8720
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8736
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8752
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8768
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8788
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8808
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8824
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8840
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8856
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8872
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8888
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:8904
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8924
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8940
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8956
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8972
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:8988
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9004
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9020
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9036
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9052
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9068
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:9084
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9104
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9128
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9144
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9160
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9176
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9200
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:7700
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:2392
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:9224
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9240
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9260
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9276
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9292
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9308
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9324
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9340
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9356
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9372
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9388
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:9404
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9420
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9440
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9456
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9472
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9488
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9504
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:9520
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9536
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9552
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9568
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9584
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:9600
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9616
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9632
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9648
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9664
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9680
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9696
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9712
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9728
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9744
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9764
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:9780
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9800
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9816
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9832
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9848
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9868
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9884
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:9904
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9920
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9936
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9952
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9968
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9984
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10000
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10016
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10032
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10048
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10064
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10080
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10096
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10112
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10128
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10144
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10164
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10180
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10200
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10216
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10232
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9432
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:9796
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10256
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10272
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10288
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10304
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10320
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10336
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10352
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10368
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10388
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10408
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10424
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10440
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10456
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10472
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10488
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10504
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10520
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10536
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10552
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10568
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10584
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10600
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10616
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10636
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10656
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10672
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10688
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10704
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10720
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10736
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10752
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10768
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10792
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10808
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10824
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10840
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10856
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10872
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10888
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10904
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10924
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10940
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:10960
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:10976
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:11004
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:11020
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵
- System Location Discovery: System Language Discovery
PID:11036
-
C:\Program Files (x86)\iWin Games\iWinGames.exe"C:\Program Files (x86)\iWin Games\iWinGames.exe"1⤵PID:11052
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x320 0x4681⤵
- Suspicious use of AdjustPrivilegeToken
PID:372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5f9fd93fd84a004097ca606fbe0a27665
SHA182455d34481ca07539a8fc4faffbcc38fd519ff7
SHA25671a6e9b27cd77a36bb80be4cbd237ece76df807f4bd0664f4d3d590f46614fc4
SHA512b778dced2953d96d7b79a23b8d3774147d6acb9527dc4c1354e5c67b99820df4d673d7c2281a1943c80dc4789e7c3cf957521a7cfa5b8b7f4521cc3df3246134
-
Filesize
120KB
MD50fa913aeea4cb78fa9129db050dd70e1
SHA184ce5ccca3ac382c34f28800cff149ab0f7c36e6
SHA256eda8c2e18d760d04cf9f5c7d88078d45fa4eb34b43a9bb39ac3c0ca45afd463c
SHA5124901fadd10ad6a01d9f4d99609723a0d172e1529572610aaa1490ea11f0fc393e857b00ba669b30dae8695e0312e2341176571a3fd57d722818c959da4fb3d90
-
Filesize
181KB
MD57b6972e9ca922d233c579806d2ff14dd
SHA18c100d8b02ef942e9798ad3ae22ae88e5e6936b6
SHA25669deff53dff5912cf382c5dda338d8172c6d9a4e726e93217414b1ae058e4f33
SHA5128e4b20e21a61c43b169b32a731688f99b566294877147547df5d049e71f2143d746cd4ca6450ed763951ec3a37e29cec4dfb64e13fce52bb30aeb97e59a4d368
-
Filesize
6.7MB
MD517031b9f00375bf94ffc8447fd270750
SHA1f4b11a2675200b94c85cc0f3baeda90fd910e492
SHA2568eebf8baa19b1e8d813586343e81a70da4c8c3d9522e7fe8eb66a96c834c9e1c
SHA51253766bb3d90eb7362178bb399d8152c037f67f8fc1ee85d198c2b64099c5d0c755a48676b98f629a85e7776e8d4f1160e2462a3c36e68d3a4a22b051db37ecd8
-
Filesize
138KB
MD5f841c2d5f930cf4ae834b67a9eba5809
SHA150d550e3d9ea5585148f644f12e33d113dd303e8
SHA2569b22d81b76219c30914dbf93f431cf72a6dc071a34fda46c4534a24eb6ca43c7
SHA512ee5f53e67826dd6542b39e5808c6bcfc4b5ddb09ef566de7167c57e7ebfe1a4dd915bb3ab6c7c6693b0b3b499dd35ca6c16f782fc11ea4262f4955a08e206702
-
Filesize
711KB
MD55892d1ca976fe424419640ea3c7d4c79
SHA10afd3a299ffabe300335fed33fc37742aa6445bb
SHA256009272ff88a3f09ccdffba20932d766251dbebb69eba06d8612175b8fe6ab180
SHA512af2a5892e3842eb0ce6b5e0cec4bda26a125c6c0e89132832e46a3004fd3cc847c5e26972ba653ca2f650790bd6229fea017e214bbcd323821aa6f017e5ab1c6
-
Filesize
172KB
MD5fe1a970e7ce330bb844e333c374c6599
SHA1fb04501d0e7693fb2753b9ffd12dae20d595ceba
SHA256e63387a285c8b6d54963b6bd71ff5a9584e3b68e5e382ae4fb088ba3d9407a82
SHA5127352a11e84ba350c0310cb73b9a17d966ed21dfbddf3845748cec0113a36abfb1d7a78c6b517ba17fe3163936c2f53aef63ddec8e637d40e6eb0ff985c1380e4
-
Filesize
94KB
MD54d3ac88054df63fc810427bdaa96c458
SHA1e4d554e03ba91f6b53a2a80253b339f56e303c94
SHA256b07ffcd0af80f6b9fba09abe816ba2f0ff0d336639f1768fc317291bc635ece6
SHA512d4732ad89bbb19b316dff1b9c534acf98bb985c89d1295f08e24b21531123426500b3712979dda2f0e941a5969c0cbca15bbd52f6c167653f96a494a6677ca54
-
Filesize
99KB
MD53d3d2bf9c42dbdf97247775c00f22190
SHA17a046170aaeb5e1a29d8c8cd7c32225f49237aa1
SHA25659f09ba2c79a209008e76d0478bb691a9fdb2180d84318d9fc73b10401aa853a
SHA5126e66c4ff467e286cd5dc1d4ccd412fec32cfd01514db6c339fd275eaab5f3b549e223e9330bc61ff19048df70b81b66dfcc78ac351aa2c5ff45cf8d197140466
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
512B
MD5fc631a606f62bf4c32305f024f98d2c1
SHA178d31131687679f09c76cfc816dffb0a320088b6
SHA256e879ee1d066ece2186cfdbe58280c82182aab4fe98a77d79a46c3926e6655114
SHA512c141357cf600f0edf547ec7668de69c3a31de4c2821617db13161ac7ffc2adfed14c5b4c070554fea73b04d91e8026452714ce8ce74c3a55bb3dbe85a547c9f4
-
Filesize
27B
MD5d3e7bd0b0643c195846f26ba6b8d4b42
SHA13cbd01c94b84e059ebb3105184d2899a238a63fe
SHA2568d80707237928316ce801a42ee461542013fba1012d31011dbb35099e42ebe31
SHA51286881ea509c5c20110b8933b4e085677167c81033737ee1c3131f6eb3fb1bf9128d731295fca03834501b5755eb13e83a1159b64bd115f4f75ff133cbdbca9b3
-
Filesize
524KB
MD5d79746389ef770201e022f971199d451
SHA184789d7e4de78e946778719e80982b056001ed58
SHA2562a2c31ec612ded841ccf3306767e2f572acb89bee13744c2714c2d3af9324a78
SHA512d69947d1cd040d9c4301c1d27dfeff14446b696360d54b639bc00e2b5187eaf05df189fc0bb18660678747e0843923dec8545bad213c1193bbd979de548563d2
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
4KB
MD550c6f5be699ac9ec70b64382db67ddf7
SHA1fdaf6a3c3e9c6f6881ca3a8a151080920dee522d
SHA256d97255fc6a83e6c42e01118dbf8ca0ca5e63905ca8fd2f629e4507f198a69843
SHA5122fd65bda08852a808e5fb46ccac50623c0ebf138c5af197804f40916770b82b74efb4e13b5b4209d85f781c3ce387143c9d8574d01ea74c3c3c88c77f80446c8
-
Filesize
1KB
MD558ab125eb5789bc730dde78851e078ac
SHA16b8030967bda561042740dea3c5c21caa2294ad5
SHA2561673ed56982d110e4cd226d2bfda48c812dfc99d708e41e676e725e2318b9a0d
SHA512f85e9ba0075415e4b42a82cc9a452e023e3efaeee7266137311dc985c63f9e8a79d8a5c9d5aa1a94fa6fe816b889ac326f10c7f8fd52805f8822776851611353